Google’s SynthID Bio can watermark AI-designed protein binders without breaking them

Google DeepMind has built SynthID Bio, a watermark for AI-designed proteins, and shown in wet-lab tests on protein binders that it leaves their function intact. The method hides a signature in the amino acid sequence of a designed protein and in the atomic coordinates of a predicted 3D structure. DeepMind says the signature can be checked on the physical protein after synthesis.

DeepMind aims the watermark at DNA synthesis screening. Providers who turn digital protein designs into physical molecules check each order against databases of known threats. AI can now produce sequences with little resemblance to known hazards, so screeners can no longer assume an unfamiliar sequence comes from an undiscovered natural organism. Verifying an unfamiliar order by hand can stall research. A watermark would give screeners an automated signal that an order came from a trusted model, one with safeguards built in.

Lab tests

DeepMind tested protein binders, molecules designed to grab a particular target protein. It paired its AlphaProteo design method with a SynthID Bio version of ProteinMPNN, a commonly used sequence generator, and ran wet-lab tests on three targets: VEGF-A, the receptor-binding domain of the SARS-CoV-2 spike protein, and PD-L1. On all three, watermarked designs matched unwatermarked versions on hit rate, binding affinity and natural sequence diversity. Hit rate is the share of designs that bind their target, so a match means the watermark did not cost researchers working binders on these three targets.

For structure prediction, DeepMind fine-tuned a small part of AlphaFold 3’s diffusion network, which builds the watermark into the model’s weights. Anyone who runs the model gets predicted coordinates that carry the signature. AlphaFold 3 keeps its prediction accuracy, and the signal holds up against digital noise and minor coordinate changes. DeepMind calls detectability near-perfect without citing a rate in its blog post.

Databases get a second use

DeepMind also points the watermark at public databases such as the Protein Data Bank, UniProt and GenBank. Many accept public submissions, and mislabeled entries can have an outsized negative effect on biosecurity decisions. At submission, the watermark could help flag synthetic entries for labeling or review.

What it cannot do yet

DeepMind lists resistance to deliberate tampering as a challenge still to be met. It suggests pairing the watermark with provenance metadata or central repositories of AI-generated biological data, and describes SynthID Bio as one layer next to model-level mitigations and customer vetting, each with potential gaps.

James Diggans, VP of policy and biosecurity at Twist Bioscience, gave early feedback on the paper. He calls watermarking “a promising new addition to the biosecurity toolbox that could strengthen screening.”

Early phage results

In ongoing work with the Hie lab at Stanford University and Arc Institute, DeepMind integrated SynthID Bio into Evo 2, a genomic model, to watermark the genome of an Evo 2-designed bacteriophage, a virus that infects bacteria. Early lab testing in bacteria cultures confirmed the watermarked phages are functional. DeepMind says a technical manuscript will follow.

DeepMind is publishing the methods paper, open-sourcing the code and in vitro data, and releasing the weights to the research community.